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The paper addresses initial steps involved in the development and flight implementation 
of new metrics driven C\ adaptive flight control system. The work concentrates on (i) 
definition of appropriate control driven metrics that account for the control surface failures; 

(ii) tailoring recently developed C\ adaptive controller to the design of adaptive flight 
control systems that explicitly address these metrics in the presence of control surface 
failures and dynamic changes under adverse flight conditions; (iii) development of a flight 
control system for implementation of the resulting algorithms onboard of small UAV; and 
(iv) conducting a comprehensive flight test program that demonstrates performance of the 
developed adaptive control algorithms in the presence of failures. As the initial milestone 
the paper concentrates on the adaptive flight system setup and initial efforts addressing 
the ability of a commercial off-the-shelf AP with and without adaptive augmentation to 
recover from control surface failures. 

I. Introduction 

Aircraft loss-of-control (LOC) accidents 1,2 comprise the largest and most fatal aircraft accident category 
across all civil transport classes and can result from a variety of causal and contributing factors occurring 
either individually or, most likely, in combination. According to the National Transportation Safety Board’s 
accident database 3 ^ 6 , 40% of all the commercial aviation fatalities from 1990 - 1996 were due to a LOC 7 . 
Causes for LOC can come from multiple sources, such as: 

• Inadequate input from the pilot: In Comair’s air taxi and commuter airplane EMB-120T accident 
the flightcrew’s decision to operate in icing conditions near the lower margin of the operating airspeed 
envelope caused wing’s icing and the subsequent LOC which resulted in 29 fatalities. 
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• Control surface failure: In US Air’s Boeing-737 the LOC resulting from the movement of the rudder 
surface to its blowdown limit as a result of a jam of the main rudder power control unit servo resulted 
in 132 fatalities. 

• Equipment damage: In Alaska Airlines MD-83 the LOC resulting from the in-flight failure of the 
horizontal stabilizer trim system jackscrew assembly’s acme nut threads resulted in 88 fatalities. 

• Change in flight characteristics of the aircraft: In American Eagle Airlines ATR-72-212 where 
a LOC attributed to a sudden and unexpected aileron hinge moment reversal that occurred after a 
ridge of ice accreted beyond the deice boots while the airplane was in a holding pattern resulted in 68 
fatalities. 

Further study of these and many more LOC accidents performed by NASA-Langley and other research 
centers determined that often pilots trying to recover from a LOC typically found themselves trying to fly 
the airplanes out of the normal operational flight envelope and in attitudes where they typically were not 
trained to fly 8 . Figure 1 shows how a LOC accident puts the aircraft in the attitude well beyond the wind 
tunnel data envelope of what is considered a “normal” flight condition. 
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Figure 1: Loss of control accident data relative to angle of attack and angle of sideslip 7 



When a failure occurs, the following critical questions must be addressed: is the failure severe enough 
that only stability can be maintained to land the aircraft anywhere possible (loss of vertical tail in DC- 10 
in Sioux City Iowa) or is there sufficient control authority left to provide a measure of performance (engine 
out with sufficient rudder authority)? In the case of a severe failure, when only stability can be maintained, 
the control metrics that must be assessed include controllability and stability margins. Due to significant 
degradation of the flight envelope controllability bounds may no longer be symmetric, for example, left and 
right bank angles may be different. Clearly, the adaptive control system employed must guarantee that 
the new limits on dynamic maneuverability and limits on the remaining control surfaces and throttles are 
not violated for the remainder of the flight for the known initial conditions and in the presence of bounded 
disturbances. This clearly motivates the use of recently developed C\ adaptive control theory 9,10 as a natural 
metric for the analysis of the adaptive control system. Furthermore, due to the presence of adaptive control 
the resulting feedback system is necessarily nonlinear, which requires the use of time-delay margin as a 
measure of robustness instead of the standard phase margin, typical of linear systems. 

On the other hand, if the failure is less severe and a certain level for performance can be maintained, 
new metrics (in addition to the ones discussed above) can be used to assess performance of the adaptive 
control system. Clearly, the most important one would be landing the aircraft on a given runway. Thus 
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the adaptive control system must follow a predefined feasible path and must guarantee that the predicted 
lateral miss distance does not exceed the width of the runway. Therefore, the lateral miss distance at the 
touch down is a critical metric that must be used to evaluate performance of the adaptive control system. 
In addition, a certain modicum of passenger comfort such as lateral and normal g loads should not exceed 
some predefined bounds (depending on the nature of the failure) throughout the remainder of the flight in 
the presence of bounded disturbances and for given initial conditions. Again this motivates the use of the 
recently developed C\ adaptive control theory as a metric par excellence to evaluate the maximum ^-loading 
produced by the actions of the adaptive control system. 

In general, an actual LOC accident takes the airplane beyond the normal flight envelope into regions for 
which aerodynamic data are not available from conventional sources (see Fig. 1). There is still limitation of 
modeling aerodynamic force and moments at high angles of attack due to time-dependent effects, unsteady 
aero-effects, and the Reynolds number effects on wind tunnel test data. Figure 1 shows that the flight 
test data are not matched with the wind tunnel data at conventional stall angle of attack. There is also 
limitation on modeling the effects of the loss of control effectiveness on aircraft dynamics. Furthermore, the 
aerodynamic changes due to either individual actuator failure or combination of several actuators may not 
be adequately modeled a priori. Thus, lack of adequacy in modeling requires an application of new adaptive 
control algorithm and also stresses the importance of system identification methods, particular for the case 
of multidimensional systems. 

The theory and practice of aircraft system identification has a long history and is very well estab- 
lished 11 13 . Modern computational methods, wind-tunnel and flight testing can provide comprehensive data 
about the aerodynamic characteristics of an aircraft. Variety of existing numerical and experimental methods 
and techniques is classified so that a researcher has a well-defined roadmap to be used in choosing the right 
method and its application. Yet, many authors concur (see subject area review in Ref. 11 ) that although 
methods exist there is still room for new identification techniques and there exist many regimes and charac- 
teristics yet to be identified. New aerodynamic configurations, engines and flight control modes, without even 
accounting for LOC due to control surfaces failures (CSF), make system identification area active as never 
before. In particular for the problem at hand, system identification contributes to the design of adaptive 
stability augmentation system through (i) obtaining more accurate and comprehensive mathematical model 
of aircraft dynamics used at the design and simulation stages, and (ii) providing verifiable estimates of the 
remaining control authority when any adverse conditions occur. 

Near optimal trajectory generation is another task to be solved online. Many advances have been made 
in recent years in this area; a comprehensive overview can be found in Refs. 14,15 . In the event of LOC, 
optimizing feasible path is of paramount importance. It should not only account for remaining control 
authority but must allow for near real time reconfiguration of the projected path. Furthermore, safety 
of the computational system is another important issue that must be addressed; in the presence of finite 
computation time, by analyzing the behavior of the implemented algorithms, the CPU time planning must 
be also performed in real time to guarantee safety of computation 16 . In application to the problem at hand 
the most computationally inexpensive modification 17 of the direct method of calculus of variations is used. 
The method allows for real-time computation of feasible trajectories and delivers near real-time suboptimal 
solutions subject to a multidimensional constraints on control functions, initial and final conditions. Onboard 
implementation of this method is numerically inexpensive and has been proven robust in various applications 
and flight experiments 17 19 . 

Furthermore, over the years, unmanned aerial vehicles (UAVs) have played increasingly important roles in 
the development of novel aircraft technologies. These vehicles are typically viewed as tools which provide low- 
risk and low-cost means for testing new advanced concepts. Over the span of last 20 years, as computational 
power has grown by leaps and bounds and the packaging of onboard electronics has been significantly 
miniaturized, UAVs are being viewed with increased interest to perform a variety of new research missions. 

The framework proposed for current development borrows from multiple disciplines and integrates of- 
fline algorithms for system identification, and online algorithms for path generation, path following, and 
C\ adaptive control theory for fast and robust adaptation. Together, these techniques yield control laws that 
meet strict performance requirements in the presence of CSF, modeling uncertainties and environmental 
disturbances. The methodology proposed for this work unfolds in three basic steps. First, given a nominal 
UAV (no CSF implemented) in wings level flight, a feasible trajectory is generated onboard for a given set 
of initial (grabbed in flight) and final boundary conditions (assigned a priori according to the scenario), a 
general performance criterion to be optimized, and the simplified UAV dynamics. 
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Next, as soon as a near optimal trajectory for nominal aircraft is generated in real time, the UAV is 
automatically transitioned to the path following mode with zero initial tracking errors. The path following 
control algorithm proposed builds on a nonlinear control strategy, which is first derived at a kinematic level, 
and leads to an outer-loop controller that generates pitch and yaw rate commands to an inner-loop con- 
troller. At a second level, the dynamics of the closed-loop UAV with autopilot are dealt with by introducing 
an inner-loop control law via the C\ adaptive output feedback controller wrapped around the autopilot. This 
Ci adaptive augmentation is what allows us to account for the UAV dynamics, guaranteeing stability and 
performance of the complete system in the presence of modeling uncertainties and environmental distur- 
bances. The main benefit of the C\ adaptive controller is its ability of fast and robust adaptation, as proven 
in Refs. 9,10 ’ 20-23 ? which leads to desired transient and steady-state performance for system’s both input and 
output signals simultaneously, in addition to guaranteed gain and time-delay margins 9,10 . The third step 
consists of introducing CSF while in path following mode. It is done without acknowledging the nominal AP 
about the failure and therefore without reconfiguring the nominal inner-loop controller; AP continues to send 
commands to the control surface that is fixed at the specified position. The ultimate objective is therefore 
to estimate the boundary of the achievable tracking performance with the most severe CSF deflection. 

Thus, C\ adaptive control theory will be considered as the framework for the development and validation 
of the metric driven adaptive control paradigm. Previous work and theoretical details of £i-adaptive control 
theory, known as The Theory of Fast and Robust Adaptation , are presented next in Section II. Motivation and 
development of a new hardware in the loop flight simulator providing advanced flight modeling capabilities 
follows next in Section III. Section IV concentrates on the preliminary development of flight test failure 
matrix including single and multiple CSF, and presents corresponding HIL simulation results. Finally, 
Section V describes the results of the flight test experimentation program implementing CSFs and the 
adaptive control algorithm onboard of the SUAV. The paper ends with the concluding remarks in Section VI. 

II. Path Following and C\ Adaptive Control 

A. Path Following Problem Formulation 

This section briefly formulates the problem of path following control for a (single) UAV in 3D space. We 
recall that path following refers to the problem of making a vehicle converge to and follow a desired feasible 
path described by some convenient time-independent parameter (e.g., path length). 

In previous work by the authors (Refs. 24,25 ) a general framework for this problem is proposed. In the 
set-up adopted, the kinematic model of the vehicle is derived with respect to a Serret-Frenet frame moving 
along the path, playing the role of a virtual target vehicle to be tracked by the real vehicle. The key idea 
involved in the approach is to consider the rate of progression of the virtual target as a degree of freedom, 
which in turn allows to decouple spatial and temporal assignments during the path generation and path 
following phases. The geometry of the problem at hand is shown in Figure 2. Given a path p c (l) to be 
followed, parameterized by a path length /, we define Q to be the UAV center of mass and P to be an 
arbitrary point on the path that plays the role of the center of mass of a virtual UAV to be followed. We 
also define the path following kinematic position- error vector qp(t) as the difference between the position of 
the UAV center of mass Q and the position of the virtual UAV P (resolved in T\ which is represented as 

q F (t) = [ x F (t ) y F (t) z F {t) ] T , 

and the path following kinematic attitude- error vector <I> e (£) as the vector of Euler angles that locally pa- 
rameterize the rotation matrix from T to a coordinate system W defined by projecting the wind frame onto 
a local level plane 

$ e (t) = [ 4> e (t) 6 e (t) 1p e (t) ] T . 

Then, as shown in Ref. 25 , the overall open- loop path following system including the autopilot and the 
aircraft dynamics can be described by a cascaded structure of the form 

Q e : x(t) = f(x(t)) + g(x(t))y(t) (1) 

Q v : y(s)^G p (s)(u(s)-hz(s)), (2) 

where the subsystem Q e represents the path following kinematic error dynamics of the UAV, and the sub- 
system Q p models the closed- loop system of the UAV with its autopilot (see Figure 3). In this framework, 
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Figure 2: Problem geometry 


x(t) = [qjr(t) (O e (t)—Se(t)) (i/; e (i)—5 7 f,(i))] T is the path following kinematic error state , where 5e(t) and S^(t) 
are some “shaping functions” a ; y(t) = [q(t) r(t)] T with q(t) and r{t) being the x-axis and z - axis components, 
respectively, of the vehicle’s rotational velocity resolved in W frame; u{t) = [q a d(t) r a d(t)] T is the vector of 
reference commands to the autopilot; while z(t) = [z q (t) z r (t)] T models unknown but bounded time- varying 
disturbances. We note that x(t) and y(t) are the only measured outputs of this cascaded system and u(t) is 
the only control input. Also, for the purpose of this paper and with a slight abuse of notation, q(t) and r(t) 
will be referred to as pitch rate and yaw rate , respectively, in the W frame. 

Then, the dynamic equations of the path following kinematic error states (subsystem Q e ) are given by b 


xp = — /(I — K(l)yp) + u cos 0 e COS^e 
ijp = —1(k(1)xf ~ + v cos 0 e sin 


Zf = - 

-K (1)Vf -vsinde 


’ Oe ' 

= D (t,O e ,ip e ) +T (t,9 e ) 

Q 

_ Ipe _ 

r 


( 3 ) 


where v(t) is the magnitude of the UAV’s velocity vector, k(1) and ((l) are the curvature and the torsion of 
the path, respectively, and 


D (t, 6> e , if e ) 


K(l) sin 

—/(£(/) tan^g cos 2 p e + k(1)) 


and T (t, 6 e ) 


cos (j) e — sin (j) e 

Sin <fi e COS 4> e 

cos Q e cos 6 e 


( 4 ) 


Note that, in the kinematic error model (3), q(t) and r(t) play the role of “virtual” control inputs. Notice 
also how the rate of progression l(t) of the point P along the path becomes an extra variable that can be 
manipulated at will. 

So far, only the kinematic equations of the UAV have been considered, for which the pitch rate q(t) and 
the yaw rate r{t) are the control inputs. Next, we consider the closed- loop UAV with autopilot (subsys- 
tem Q p ) with input u(t) = [q a d(t) r a d(t)\ T and output y(t) = [q(t) r(t)] T , which is in turn the input to the 
subsystem Q e . The subsystem Q p is assumed to have the (decoupled) form 


Q . J q(s) = Gg(s) ( qad(s ) + 2: 9 (s)) 
\ r(s) = G r (s) (r ad (s) + z r (s )) 

a We refer to Ref. 25 for details in the definition of 6e(t) and 
b See Ref. 24 for details in the derivation of these dynamics. 
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Figure 3: Cascaded path following error dynamics with UAV dynamics 


where G q (s ), G r (s) are unknown strictly proper and stable transfer functions and z q (s ), z r (s ) represent 
the Laplace transforms of z q (t) and z r (t), respectively. In Ref. 25 , we justify the adoption of a linear time- 
invariant model for the UAV together with its autopilot. 

Then, given a desired path to be followed, the control objective is to stabilize x(t) by proper design of 
u(t) without any modifications to the autopilot. 


B. Stabilizing Function for the Path Following Kinematics (outer- loop) 

As shown in Ref. 25 , in the ideal case where Q p is the identity operator, if the rate of progression of the 
point P along the path is appropriately chosen, then there exist stabilizing functions q c (t ) and r c (t) for q(t) 
and r(£), respectively, leading to local exponential stability of the origin of Q e with a prescribed domain of 
attraction. A formal statement of this semi-global result is given in the lemma below. 


Lemma 1 Let the progression of the point P along the path be governed by 

l = K\X F + v cos 0 e COS^e 5 
where K\ > 0, and define the input vector y c {t) as 


He — 


Qc 

r c . 


= T- L (t,0 e ) 


u e c 


- D(t,0 e ,1p e ) , 


(6) 


(7) 


where uq c ( t ) and u^ c ( t ) are given by 


v (a x n , c 2 sm 0 e — sm 6 $ ■ 

U0 C = —Kfive — 00) H z F v h 00 

Cl 0 e — S e 

r ( f x \ c<2 a sin - sin ^ • 

ujj c = -Ks{fi> e -djj) y F vcos6 e + Ow, . 

C l fie ~ 


(8) 


with some K 2, K3, c 1, > 0 C . Then, the origin of the kinematic error equations in (3) with the controllers 

q(t) S q c (t), r(t) = r c (t) defined in (7) -(8) is exponentially stable with some domain of attraction U. 


Proof. The proof of this Lemma can be found in Ref. 25 . 


□ 


C. C\ Adaptive Output-Feedback Augmentation (inner-loop) 

The variables q c (t ) and r c (t) generated by the (outer- loop) path following algorithm must be viewed as 
commands to be tracked by appropriately designed inner-loop control systems. Since commercial autopilots 
are normally designed to track simple way-point commands, the pitch and yaw rate commands computed 

c We refer to Ref . 25 for details in the choice of the parameters K 1, K2 , K3, c 1, and C2. 
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£ Augmentation 



Figure 4: C\ adaptive augmentation loop for pitch rate control 


before are modified by including an /^-adaptive loop to ensure that the closed-loop UAV with the autopilot 
tracks the commands q c (t) and r c (t) following a desired reference model M(s ), i.e. 

q(s) « M(s)q c (s) and r(s ) « M(s)r c (s), 

where M(s) is designed to meet the desired specifications. In this paper, for simplicity, we consider a first 
order system, by setting 

M(s) = — — — , m > 0 . 

The philosophy of the C\ adaptive output feedback controller is to obtain an estimate of the uncertainties 
of the plant, and define a control signal which compensates for these uncertainties within the bandwidth of a 
low-pass filter C(s) introduced in the feedback loop. This filter represents the key difference of C\ adaptive 
control from conventional MRAC, and guarantees that the C\ adaptive controller stays in the low-frequency 
range even in the presence of high adaptive gains and large reference inputs. The choice of C(s) defines the 
trade-off between performance and robustness 10 . Adaptation is based on the projection operator, ensuring 
boundedness of the adaptive parameters by definition, and uses the output of a state predictor to update the 
estimate of the uncertainties. The C\ adaptive control architecture for the pitch-rate channel is represented 
in Figure 4 and its elements are introduced below. 

State Predictor: We consider the state predictor 

q(t) = -mq(t) + m (q ad (t) + a q (t)) , q(0) = q(0) , (9) 

where the adaptive estimate cr q (t) is governed by the following adaptation law. 

Adaptive Law: The adaptation of <J q (t) is defined as 

°q(t) = r c Proj(dg(£), -g(£)), <r g (0) = 0, (10) 

where q(t) = q(t) — q(t) is the error between the state predictor and the output of the actual system, r c E M + 
is the adaptation rate subject to a computable lower bound, and Proj denotes the projection operator 26 . 
Control Law: The control signal is generated by 


qad(s) = C(s) (r q (s) - a q (s)) , 


( 11 ) 


where r q (t) is a bounded reference input signal with bounded derivative, and C(s) is a strictly proper low-pass 
filer with (7(0) = 1. In this paper, we consider the simplest choice of a first order filter 

C(s) = — — — , ijJ > 0 . 

The complete C\ adaptive output feedback controller consists of (9), (10) and (11) subject to the following 
stability condition: the design of C(s) and M(s) needs to ensure that 


H(s) = 


G q (s)M(s) 


C(s)G q (s) + (1 — C(s))M(s) 


(12) 
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Figure 5: Closed-loop cascaded system with C\ adaptive augmentation 


is stable d . 

Then, given the C\ adaptive augmentation above, it is possible to derive a performance bound for 
system’s output q(t) with respect to the reference command q c (t). Next lemma states this key result. We 
avail ourselves of previous work on C\ augmentation and its application to path following 23,25 . 

Lemma 2 Let r q (t) be a bounded reference command with bounded derivative. Given the C\ adaptive con- 
troller defined via (9), (10) and (11) subject to (12), if the adaptation gain T c and the projection bounds are 
appropriately chosen 6 , then we have 

\\q~r q \\ r < 7<9 with lim 70 = 0 . 

00 r c — >00 

u;— »• 00 
m— >00 

Proof. The proof of this Lemma can be found in Ref . 25 . □ 

Similarly, if we implement the C\ adaptive controller for the yaw-rate channel, with a similar bound for 
the initial condition on the yaw-rate, we can derive 

||r-r c || £oo < 7.0 (13) 

with 7*0 > 0 being a constant similar to 70 . 

D. Path Following with C\ Adaptive Augmentation 

As proven in Ref ., 25 the path following closed- loop system with the C\ augmentation (see Figure 5) is stable. 
In particular, the C\ adaptive augmentation ensures that the outer- loop path following commands q c (t) and 
r c (t) and their derivatives q c (t) and r c (t) are bounded, which in turn allows to prove that the original domain 
of attraction for the kinematic error equations Ll can be retained. This key result is stated next. 

Theorem 1 Let the progression of the point P along the path be governed by 

l(t ) = Kixp(t) + v(t) cosO e (t) cosfi e (t ) , (14) 

where K\ > 0. There exist control parameters T c , iv, and m such that the (nonlinear) control laws q c (t ) and 
r c (t ) in Lemma 1 are bounded with bounded derivatives, and moreover they ensure that, if x( 0) G Q, then 
x(t) G Ll for all t>0, and thus the path following closed-loop cascaded system is ultimately bounded. 

Proof. The proof of this Theorem can be found in Ref . 25 . □ 

d This stability condition is a simplified version of the original condition derived in Ref. 23 , where the problem formulation 
includes output dependent disturbance signals z(t) = f(t,y(t)). 

e See Ref. 25 for a detailed discussion and derivation of the design constraints on the adaptation gain r c , the bandwidth of 
the low-pass filter uj, and the bandwidth of the state-predictor m. 
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Wireless Link 



Figure 6: HIL setup; new Simulink-based 6D0F model is a centerpiece of the Simulator 


Remark 1 We notice that the approach proposed is different from common backstepping-type analysis for 
cascaded systems. The advantage of the above structure for the feedback design is that it retains the properties 
of the autopilot, which is designed to stabilize the inner-loop. As a result, it leads to ultimate boundedness 
instead of asymptotic stability. From a practical point of view, the procedure adopted for inner /outer loop 
control system design is quite versatile in that it adapts itself to the particular autopilot installed on-board 
the UAV. 


III. Hardware in the Loop and Flight Test Setup 

A. Motivation and Development of New HIL Simulator: Architecture Description and Ca- 
pabilities 

Many of the current Commercial Off-The-Shelf (COTS) autopilots offer software simulators to perform 
HIL development, testing and training. Although these simulators work well in general, they are quite 
limited when one tries to simulate complicated phenomena or use non-standard aerodynamics. For instance, 
simulating CSF, a combination of failures or employing a different plant model from the one pre-programmed 
is simply not possible using these products. 

Due to these limitations, the task of developing a new, more versatile HIL simulator, was recently 
accomplished. The newly developed HIL simulator has the ability to simulate any dynamic model using 
Simulink. 27 In general, this model is used to generate synthetic sensor data for the autopilot and has the 
possibility to receive back control commands directly from the AP. This set up offers flexibility not previously 
available in standard Piccolo setup and, provided that a plant model obtained by system identification (see 
Section B) is accurate, reduces the amount of parameter tuning when transitioning from HIL to real flight 
implementation . 

The Piccolo Plus AP 28 is the core element of the current Rapid Flight Test Prototyping System (RFTPS) 29,30 
developed at the NPS. This AP interacts with its own HIL simulator via a Controller Area Network (CAN) 
bus. It is able to send control surface commands and receive simulated sensor readings from a PC via a 
CAN to USB converter cable. In order to replace the standard Piccolo Simulator with a new Simulink-based 
one two main components were necessary to build: an interface to the CAN/USB data bus and a 6-DOF 
dynamic model. The complete HIL architecture is shown next in Fig. 6 and the components of this new HIL 
simulator are described in more detail in the following subsections. 
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1. Simulation PC 

The simulation PC is responsible for generating coherent sensor data for the AP and responding to the AP 
commands in real time. It consists of two main components: a USB-UDP converter and the 6-DOF Simulink 
model. 

The USB-UDP converter is an application developed in C++. It reads the incoming control surface 
commands from the AP (via USB) and writes them to a UDP port for Simulink model. It also listens to a 
UDP port where it receives sensor readings data from Simulink model in a predefined format, parses these 
readings and sends them back to the AP via USB. 

Simulink is “an environment for multidomain simulation and Model- Based Design for dynamic systems” 27 
and therefore is a natural choice for a simulation engine. To this end, a Simulink blockset was developed 
consisting of two components: (i) a source which listens on a predefined UDP port and parses messages in 
order to translate them into the control surface commands (up to 10 different control surfaces); and (ii) a 
sink, with inputs for the traditional sensors (accelerometers, gyros, magnetometers, GPS, dynamic and static 
pressure, temperature, engine RPM). This sink parses the data and writes it back to a predefined UDP port 
in the correct format. 31 

This setup alone fully replicates the standard capability of the Piccolo HIL Simulator and also extends 
it by making use of the flexibility of Simulink as a powerful simulation environment. 

2. Operator Interface PC 

The Operator Interface (OI) 28 is a standard software component of Piccolo-based setup. The 01 provides 
functionality to configure the AP gains, set navigation waypoints, monitor the sensor data and display the 
UAV in a geo-referenced map. It is connected to the Piccolo Ground Station (PGS) via a serial cable, in 
turn the PGS communicates with the AP via a 900MHz serial wireless link. 

The ground-based Simulink GUI is used to tune the C\ adaptive controller and the path generation 
and path following algorithms being executed onboard in the PC- 104 computer. In HIL configuration it 
communicates with the PC- 104 computer via a wired local area network (LAN) using the UDP protocol; in 
flight the wired LAN is substituted by the Wave Relay 32 wireless mesh link. This GUI also provides flight 
data monitoring and logging as well as facilitates the analysis of the telemetry data via several MatLab 
scripts. 

3. PC- 104 Target Computer 

The PC- 104 remote computer closes the outer control loop by sending control commands back to the AP. 
The PC-104 runs the xPC Target real-time kernel, 33 the C\ controller and the path generation/following 
algorithms and communicates with external world over UDP. The model that implements the algorithms is 
built in Simulink and then automatically translated to C code and compiled into real time binary code from 
within the Simulink environment. This makes the use of Simulink as an ideal development and prototyping 
platform. The communication between the AP and the PC- 104 is accomplished trough the serial port (RS- 
232). The connection is based on the real-time full-duplex serial interface 29, 34 (based on s- function technique) 
that links PC- 104 computer to the AP. This serial interface has proven to be reliable and robust over many 
hours of HIL simulation and numerous flight tests. 

B. System Identification 

Adequate modeling is a keystone of any successful control system design. Although very important and 
time consuming by itself, the system identification part of the project will be presented briefly, providing 
enough details to understand the concept. As already mentioned in SectionI there are still limitations to 
modeling aerodynamic forces and moments. Although the aerodynamics of a small UAV of standard high- 
wing configuration employed for this project is traditional and is not difficult to identify, the aerodynamics 
of this UAV changes drastically as soon as CSF is activated. In order to produce a reliable solution for the 
nominal and impaired models the following strategy of system identification is proposed, see Fig. 7. 

Starting with initial measurements of the mass and geometry characteristics the LinAir 35 code is employed 
to produce initial estimates of basic aerodynamic terms represented by the traditional regression model 11 for 
the complete configuration. Next a series of flight experiments was designed to measure airplane responses to 
a single-input (one channel at a time) doublet commands. Instrumentation of the airplane to measure data 
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Corrections 



Figure 7: System identification architecture 


adequately is presented in the following section; it follows general instrumentation recommendations that can 
be found in Refs. 11,12 and references therein. To acquire the response data the built-in capability of Piccolo 
AP has been used; it allows for 100 Hz data sampling during the interval of performing the preprogrammed 
doublet . Series of doublets for open-loop system was performed separately in aileron, rudder and elevator 
channels in order to excite the UAV so that the data contains sufficient information for accurate system 
identification. When accomplished, the classical regression based off-line identification technique 11 was first 
used to improve initial estimates of basic aerodynamics and control derivatives of the nominal airplane. At 
this step the moderate-fidelity Rascal model was identified. 

Wrapping the traditional technique with the less known Parameter Space Investigation (PSI) method 36 
is used specifically to to assist in identifying the structure of the regression model especially for the CSF 
regimes. The PSI method has been developed to address a correct statement and solution of the multi criteria 
optimization (identification) problem. The principal advantage of this method consists in the fact that the 
formulation and solution of the task comprise a single process. At every step of the process, an intellectual 
input of the designer can be seamlessly integrated to the task therefore modifying its formulation (statement) 
but preserving and integrating acquired data into the final result. The PSI method, being implemented in 
the software package MOVI 1.3 36 , has been implemented on top of the highly flexible MATLAB/SIMULINK 
system modeling and analysis environment through the shared-memory interface 37 . This implementation 
easily allows one to incorporate nonlinear multi-criteria vector optimization/identification into any design 
task that is implemented in any of the MathWorks’ products. 

C. Aircraft Instrumentation and Flight Test Setup 

The Avionics of the RASCAL UAV consist of four major functional groups that are shown in Figure 8: (i) 
a high-bandwidth Persistent Systems WaveRelay wireless mesh router 32 that provides communication with 
the ground based control PC, (ii) a PC-104 computer that executes the control algorithm and communicates 
with the AP, (iii) a Microbotics digital Servo Switch/ Controller (SSC) 38 that allows for multiple sources 
of servo control, and (iv) the Piccolo Plus AP that implements the inner-loop stabilization and reference 
following. Most of these components except the digital multiplexor comprise the regular instrumentation of 
the RFTPS setup described in Ref. 30 . 

The SSC was included in the avionics to allow for a pre-programmed single or multiple control surface 
failures; the CSF setup is configured on the ground before each flight but enabled on-demand from the second 
pilot console during the flight. This SSC is a highly configurable, multiplexing switch that allows the dynamic 
selection from three different sources of signals to pass-trough to the control surface actuators. These sources 
are: (i) asynchronous serial communication packets from the PC- 104 computer used to generate the failure; 
(ii) the signals from a conventional RC receiver that is used as a fail-safe mechanism in case the AP fails to 
stabilize the UAV; and (ii) the PWM signals from the nominal AP to the control surfaces. This architecture 
allows the user a complete flexibility in defining the nature of the failure. This failure may be configured 
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SIG Rascal UAV 



Figure 8: Flight test architecture; integrating digital multiplexer allows for multiple sources of control 


to be either one or multiple surfaces and be either a hardover, a neutral position or an oscillating failure as 
described in Section I. 

Another addition to the RFTPS (not shown in Figure 8 for the sake of clarity) is a set of CMOS solid 
state video cameras used to record digital video of the simulated CSF; these cameras (Figure 9) are mounted 
on the airplane so that they continuously observe the control surfaces involved in the experiment. The 
footage produced by these cameras is recovered for further after- flight data analysis. 

The airframe utilized as a UAV is one employed by many universities and government labs for research, 
the Sig Rascal 110, shown in Figure 10. The airframe has a 2.8 m wing span, uses a 26 cm 3 gas engine, and a 
take-off weight of about 10 kg, including 1500 cm 3 of gas and enough battery power to provide 120 minutes 
of flight time. The Rascal can be purchased in an Almost-Ready-to-Fly (ARF) form, making it an extremely 
cost-effective way to prototype new flight- control systems. The airframe has ample cabin room for the Piccolo 
AP, the desired computing hardware, sensors, and batteries to provide power to ah the avionics. 

IV. Control Surfaces Failure Matrix and HIL Results 

This section presents the main results obtained with the new HIL simulator described in Section III. A. The 
simulations demonstrate that, if there is enough control authority left, the C\ adaptive augmentation allows 
for safe recovery from the failure with guaranteed transient performance, while the remaining control author- 
ity may be used to track the turn rate reference commands. The simulations provide also useful information 
about the maximum level of CSF severity that the inner-loop controller is able to compensate for, and the 
control authority left to control the UAV for every particular failure or combination of failures. Finally, 
for the case of path following, it is shown that the control algorithm with C\ augmentation introduced in 
Section II is able to stabilize and steer the UAV along the path in the presence of control surface failures, 
significantly improving performance of the nominal non-augmented control system. 

A. Development of CSF matrix 

The proposed failure matrix is built around 8 control surfaces available for independent control of the NPS 
UAV. As explained in Section III, both HIL and flight test setups offer a great degree of flexibility, allowing 
one to introduce different single and multiple CSFs. In this paper, as an initial development stage of the 
project, only single aileron failures, single rudder failures, and combined aileron/rudder failures have been 
considered (see Table 1). 
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Figure 9: Videocameras used to record the control surface “failures” 



Figure 10: SIG Rascal 110 research aircraft 
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Table 1: Simulation and HIL CSF Results 


B. HIL Results 

The first step consisted of running simulations where the inner-loop controller was asked to track constant 
turn rate commands (of different amplitudes) in the presence of the control surface failures considered in the 
failure matrix in the previous section. These simulations provided valuable information about the maximum 
level of failure severity that the inner-loop controller can compensate for with and without C \- augment at ion, 
as well as the remaining control authority for every particular failure. 

The results showed that the nominal non-augmented autopilot is not able to track the reference signal in 
the presence of failures, whereas the C \ -augmented inner- loop adapts to provide good tracking performance 
with desired recovery transient recovery. Cumulative tracking errors and control efforts were used as metrics 
to evaluate the performance of the inner-loop in recovering from the control surface failure, while the lateral 
and normal accelerations provided information about the structural stress on the platform and the quality of 
the recovery transient. Results were obtained for 0 0.05 0.10 and 0.20 ^ turn rate commands. 

During the second step, and motivated by challenging mission scenarios such as safe landing in the 
presence of control surface and/or engine failures, the complete path following control algorithm was tested 
in the HIL simulator in order to evaluate the performance of the closed- loop system when affected by failures. 
Figures 11 and 12 show one of the results of these HIL simulations. Particularly, the CSF considered here is 
a 3 deg left aileron hardover. As it can be seen in Figure 11, the path following control algorithm without 
C\ adaptive augmentation is not able to recover from the failure and track the desired path. Figure lib 
shows that, in the presence of the failure, the autopilot itself is not able to track the reference command 
coming from the outer- loop algorithm and we lose control of the UAV. Instead, if the autopilot is augmented 
with the Ci adaptive controller, the UAV is able to recover from the failure and the path following control 
system uses the remaining control authority to steer the UAV along the path, as shown in Figures 12a 
and 12b. In particular, Figure 12b shows how the Ci adaptive controller modifies the turn rate command 
from the outer- loop algorithm so that the actual UAV turn rate tracks it, while Figure 12c shows that both 
the right aileron and the rudder help compensate for the left aileron hardover. Figures 12d and 12e show, 
respectively, the time responses of the state predictor, and the estimation of the uncertainties along with 
the resulting Ci control contribution. From these figures, one can easily observe that, for the healthy UAV, 
the contribution of the Ci augmentation to the command sent to the autopilot is almost zero; whereas, as 
soon as the failure appears, the Ci augmentation starts contributing (with desired transient recovery) to the 
command. Figure 12b illustrates also that the remaining control authority in the presence of the aileron 
failure is not enough to track outer-loop commands greater than +0.05 Then, when the outer-loop 
commands such a reference, this limitation leads to saturation of the Ci adaptive controller, as it can be 
seen in Figure 12e. In any case, the path following with Ci augmentation keeps the closed- loop control 
system stable all the time. 

We note that, in this approach, the autopilot does not know that the failure occurred, and thus there is 
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(a) Path tracking (2D projection). 
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Figure 11: HIL. Path following without C\ adaptive augmentation. 


no need for failure detection and isolation (FDI) in order to compensate for the failure: the C\ augmented 
inner- loop adapts to the new dynamics of the plant, and the UAV can be steered along the path using the 
remaining control authority. We also note that, in order to guarantee, for example, safe landing capabilities 
in the presence of failures, information about the remaining control authority should be supplied to the 
trajectory optimization algorithm in order to generate a new path for safe landing of the impaired airplane. 
^From the discussion above on the internal signals of the C\ adaptive controller, one can conclude that the 
presence of a failure can be directly detected from the nonzero C\ contribution to the outer-loop command. 
Moreover, since the presence of the failure does not affect the structure of the autopilot or its parameters, the 
remaining control authority is correlated to both the autopilot internal command saturation limits and the 
amplitude of the C\ contribution. However, further theoretical and experimental study should be conducted 
on the identification and management of the remaining control authority. 

V. Flight Test Results 

In this section, sample results from a series of flight experiments implementing real CSF are shown 
providing some insight primarily into the recovery capabilities of real system with C\ augmented path 
following algorithm. It also serves the auxiliary function of proving the correctness of the concept adhered 
to the project through analyzing the consistency of principal results obtained in the control system design 
and pure software simulation, HIL simulation and flight test stages of the programm. 

A. Flight Testing Procedure 

The flight testing was performed over a span of several days in July 2008, in Camp Roberts CA. Flight test 
setup is identical to the one presented in HIL section except that sensor measurements are not simulated. 
In the first series of flights, the parameters of the PID gains for the nominal AP, path following kinematic 
controller and C\ augmentation loop were those obtained in HIL simulation. A small tuning of C\ aug- 
mentation loop decreasing the bandwidth of both estimator and low pass filter was initially performed to 
test more conservative and therefore less aggressive augmentation. Later on, when nominal performance of 
the healthy system in path following mode with C\ controller enabled was verified, the original parameters 
were applied. More details on tuning the path following controller and the C\ adaptive augmentation can 
be found in Ref. 25 . 

Overall, two series of CSF test were performed: first, a left aileron hardover; and second, a rudder 
hardover. After every takeoff, the UAV was trimmed in wings level flight, which allowed us to capture the 
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Figure 12: HIL. Path following with C\ adaptive augmentation. 
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trim positions for all the control surfaces. Then, these trim deflections for ailerons and rudder were used 
as a reference level to introduce the failures and to evaluate the severity of the failure. It is also necessary 
to note that the CSF was introduced with a small delay (usually not more that 2-3 seconds) after the path 
following algorithm was engaged. This is due to the fact that the confirmation of the CSF command were 
sent from the secondary pilot console that triggered the digital switch onboard (see Fig. 8). 

B. Testing Ailerons and Rudder Channels 

The first set of figures illustrates the performance of the system with two levels of left aileron failure at 
—2 deg and —10 deg (trim value for the left aileron was captured at —2.34 deg). Although there were 6 
trials performed starting at 0 deg and ending at —12 deg of a left aileron hardover, these two cases provide 
better inside on the C\ contribution. The —12 deg of a left aileron hardover resulting in —14.34 deg of total 
aileron deflection was a marginal case when the closed-loop system was marginally stable. Therefore, the 
previous step was chosen as a margin for the C\ controller recovering capability. 

Analysis of the —2 deg case shows that even such small deflection pushes UAV away to the right from the 
commanded trajectory (while the generated path turns left, Fig. 13a) resulting in almost 25 meters lateral 
miss distance, see Fig. 13b). Initial rate transient (Fig. 13c) is almost negligible, although its effect is better 
seen on the trajectory plot; the C\ is ON and r response follows r a d command perfectly well. The introduced 
CSF results in the UAV taking next 20 seconds to converge to 5 meters lateral error boundary. The attitude 
angles (Fig. 13e) show that although with induced right turn the UAV is capable to keep banking to the 
left (mean value at —10°) for the entire duration of the experiment, therefore following the trajectory. In 
particular, rates plot confirms that the C\ adaptive controller ( r a d ) modifies the turn rate command from 
the outer-loop (r c ) algorithm so that the actual UAV turn rate (r) tracks it, while the CS deflection plot 
(Fig. 13d) shows that both the right aileron and the rudder compensate for the left aileron hardover. History 
of the control surface deflection confirms that the AP continues sending commands to the left aileron since 
it is not aware of the failure. With the total deflection of failed aileron at —4.34 deg the control algorithm 
forces the inner-loop of nominal AP to deflect both the symmetric aileron and the rudder, that significantly 
helps in tracking the given path. The plots of lateral and normal accelerations (Fig. 13f) show that, while in 
failure mode, the accelerations are well maintained, and therefore the UAV does not experience any excessive 
load providing ride quality. 

The results of the —10 deg left aileron failure (Figure 14) are almost identical to the previous case. 
The errors and the compensating control efforts are increased due to the increased severity of the failure. 
The analysis shows uniform degradation of tracking performance that allows for easy prediction of the 
performance bounds, that is extremely important for such a challenging situation. Overall, the controller 
recovers from the severe failure taking longer time ( 30 seconds) to converge to the same 5 meters lateral 
error boundary. 

Experimenting with the rudder failures confirmed its significant control authority in the lateral channel. 
As a result much smaller range of rudder failure was achieved. The following set of figures (Fig. 15) illustrates 
the performance of adaptive controller. Analysis of even 0 deg rudder failure shows significant loss of 
controllability: the lateral error (Fig. 15b) rises up to 35 m, it takes longer time to recover from the transient 
(30 s) to the same 5 meters lateral error boundary. The fact that the rate response r (Fig. 15c) is 90 deg 
off-phase from the commanded r a d (AP still commands turn rate through rudder, but only ailerons are 
available) for both cases of failure confirms that the C\ controller automatically re-adjusts the turn rate 
command to the fixed, but unknown, mixing of the aileron to rudder channels. The case of —2 deg rudder 
failure shows the boundary performance of the augmented system in recovering the path following. 

The fact that the nominal AP cannot track a given path without C\ augmentation is explicitly illustrated 
next in Figure 17a where system response to 1 deg rudder failure without C\ is shown.. Figure 17b shows 
dynamics of lateral error with the rudder fixed at 1°. The non- stabilizing divergence of the lateral error 
provides the most illustrative proof of that. 

Initial evaluation of the C\ adaptation performance in recovering the UAV in the path following mode 
under the CSF was based on the following two representative metrics. The first one reflects the lateral 
tracking error by analyzing the maximum lateral deviation from a commanded path - max (\yf\). The 
second one represents the desire to obtain sufficient indication of structural stress and ride quality best 
reflected by the maximum lateral and normal accelerations - max ( | N y | ) , max ( | N z | ) . Analysis of the obtained 
results is presented in Table 2, clearly identifies that even in relatively high lateral CSF hardover, the 
proposed C\ adaptive controller provides bounded tracking error and relatively mild structural stress and 
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Figure 17: HIL. Path following with 1 deg rudder hardover and L\ disabled. 


ride quality. Applying ride quality rating model 39 to the filtered values of lateral and normal accelerations 
the Uncomfortable (4) level was achieved for the most severe case of aileron failure and Very Uncomfortable 
(5) for the corresponding rudder case. 



Rudder 0° 

Rudder 2° 

Aileron —4° 

Aileron —12° 

max (I2//I) > m 

35.41 

106.9 

24.2 

7.27 

max (|-/V y |), g 

0.35 

0.36 

0.39 

0.7 

max (\N Z \), g 

1.67 

1.84 

0.7 

2.41 


Table 2: Lateral Tracking, Structural Stress and Ride Quality Results 


VI. Concluding Remarks 

In conclusion it can be stated that integrating C\ adaptive output feedback augmentation controller 
onboard of a small UAV brings unprecedented benefits in the situations when the UAV is in adverse flight 
conditions or is subject to the control surfaces failures. Since the nominal autopilot is not aware of a 
failure of one or several control surfaces, the integration of C\ adaptation allows for the fault detection 
and isolation task to be solved automatically without the need for reconfiguration of the existing inner-loop 
control structure of the nominal AP. As a result, the C\ augmented controller readjusts the control input 
that stabilizes the impaired airplane and uses the remaining control authority to steer the airplane along the 
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redefined path. Therefore, integrating C\ adaptation onboard increases the fault tolerance of the system. 

Initial development of the control quality metrics resulted in establishing a set of qualitative measures 
that were verified experimentally in HIL and flight testing. It was experimentally shown in extensive HIL 
and flight testing that C\ augmented system exhibits uniform degradation of tracking performance in the 
presence of increasing severity of the CS failure. Theoretical and experimental study of the remaining control 
authority and robustness is in progress. 

On the experimental side of the project several major milestones were achieved including development of 
a new HIL simulating capability for a Piccolo Plus AP that allows for advanced modeling of non-conventional 
airplane configurations and aerodynamics using convenience of Simulink development environment and con- 
trol design toolboxes. Furthermore, new modification of the RFTPS was developed providing a rigorous 
capability of flight testing of the airplanes with complex failures of control surfaces in various flight regimes 
and configurations. 
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